Progress review

Ministry of Defence

Reviewed May 2019 Contents

Background 3 Headline finding 3 Progress since the IMA and Next steps 3 Annex A – 2017 recommendations 8

© Crown copyright 2020.

You may use and re-use the information featured in this report (not including logos) free of charge in any format or medium, under the terms of the Open Government Licence v3.0.

Any enquiries regarding the use and re-use of this information resource should be sent to psi@nationalarchives.gsi.gov.uk Background

- The National Archives’ Information Management Assessment (IMA) programme was set up to review standards of information and records management in government organisations.
- The Ministry of Defence (MOD) was last spot checked in 2009 and fully assessed in 2011. The National Archives undertook an IMA reassessment in February 2017. Arising from that reassessment were six recommendations. This report focusses on developments under the same headings, references progress against the recommendations and next steps to achieve higher ratings where applicable.
- Note – where evidence has been provided that is relevant to the recommendations in the 2017 reassessment report these are signposted with an R and the corresponding recommendation number, such as ‘R2’.

Headline finding

- The MOD Knowledge and Information Management (KIM) team have completed many of the points set out in their ambitious action plan. In particular, there has been significant progress with the rollout and implementation of information management within MODNET (Microsoft Office 365) and have a much more mature and comprehensive information management platform than at the time of the IMA. They have succeeded in gaining KIM influence in technology rollout, refresh and procurement (see section 2). As a result of this ‘Supporting Information through Technology’ and ‘Providing Guidance’ have been uprated.

- The KIM team need to build on this success and continue to iron out the next stage of Information management within the O365 platform: more comprehensive retention, review and disposal/selection for transfer to The National Archives.

Summary of progress since the IMA

1 The value of information

| Section | IMA 2017 | Review 2019 | |--------------------------------|-------------------|-------------| | Communicating and realising value | Development area | Development area | | Managing information as an asset | Satisfactory | Satisfactory |

- KIM staff have prepared a vision for knowledge and information management and developed a focussed strategy. Text from this has been submitted for inclusion in the update of the Defence Information Strategy (DIS). With the new functional leadership structure and the creation of the Information Steward post, this strategy will be reviewed before being published to ensure it aligns with the new structure and strategic direction. When publication does happen the intention is for the strategy to be shared at the cross-MOD 1\* Information Governance Board as part of a wider communication plan to accompany the publication. (R1)

- A pilot adoption and change management programme in the context of O365 has been completed. Lessons learned from this are influencing the refresh of the Records Management Training Course. The refresh of the training will focus on the shift from paper record keeping to digital information management and will continue to be available to all information management staff at all grades across MOD. (R4)

- Information Asset Owner (IAO) definitions and guidance have not been updated. These will be reviewed in conjunction with the Data Protection Officer team. (R2)

Next steps to further improve ratings:

- Publish and publicise strategy. Monitor progress against the strategy's deliverables, measuring improvement in information management.
- Complete training refresh, publicise and pilot with users taking on-board any feedback
- Liaise with Data Protection Officer Team, to ensure any updates to the IAO role and guidance reflect the wider Information Management responsibilities of this key role. Ensure that any changes to the IAO role that may effect MODs wider KIM monitoring and assurance process are managed.

2 Digital information and supporting technology

| Performance rating | IMA 2017 | Review 2019 | |------------------------------------------|-------------------|-------------| | Supporting information through technology| Development area | Satisfactory| | Digital continuity and IT change | Development area | Development area |

- Migration from Meridio to HP Records Manager (HPRM) has taken place. Reporting shows migration was successful. A HPRM user guide is being developed, it will be put out to the Top Level Budget Holders (TLBs, roughly equivalent to directorates) for comment before being finalised and made available to users. Records will remain available and searchable in this system but new information can only be created in MODNET. The first corporate born digital records will be transferred to The National Archives from HPRM. The Defence Business Services team at Portsmouth need to work with The National Archives to establish a process for export and transfer from this system. (R5)

- In parallel, the DBS team also need to establish the process for transferring the operational digital records that will come via the historical branches. The first transfer via this route is due this year. (R5) The National Archives will be happy to support MOD with this new strand of work.

- MOD's roll out of O365 (MODNET), which began in August 2016, is now complete. Since August 2017, labels have been set up for users to manually identify and classify records and apply retention periods within SharePoint libraries. There are two retention periods to prompt review at seven and fifteen years and six labels that mirror MOD's Appraisal Report and the Defence Knowledge and Information Management policy and procedures (JSP 441). The KIM team need to monitor the use of labels to see that they are being used correctly and the proportion and distribution of information being labelled as records is as expected. The KIM team also need to establish a process for aggregating and assigning records for review when retention periods expire. The vast majority of information within MODNET is in Microsoft Exchange. The KIM team need to establish a process for review and selection of email alongside the review and selection of records from within SharePoint libraries. These are all issues that MOD are discussing with other O365 GKIM user group members and Microsoft. (R3)

- A member of the KIM team sits on the O365 Governance board and the Design Authority for ICT and Digital (DIDA) board, which reviews any new software or upgrade proposals from across MOD against an established set of criteria. New applications must pass this board before they can be rolled out.

- The KIM team have published specific rules and guidance documents for all O365 applications that cover the information management approach to take and are available for all users but aimed at Information Managers. MOD have also shared these documents with the O365 Cross-Government KIM User Group for the benefit of other departments. These guidance documents are different from the wider ‘technology agnostic’ policies which apply to all the systems in use across MOD and focus on immutability of information and audit trail. (R4)

- OneDrive and Mailbox metrics are now produced monthly. TLBs have been asked to challenge those individuals who are storing large amounts of data in their personal storage areas on a regular basis. As O365 has bedded in, awareness across the department of the limitations of OneDrive in an information sharing environment has risen.

- Since May 2018 MOD have been pushing Teams and Groups as the preferred method of collaboration and team working to promote behaviour change. That said it is still up to business areas to set up their O365 infrastructure and ways of working to suit their business needs. If take up of Teams is popular the KIM team will need to think about whether it’s current policy of saving information from a Team into a SharePoint library in order for it to subsequently be treated as a record is sustainable (retention scheduling/labelling currently only applies to information within SharePoint libraries). (R2)

- MOD’s contribution to the Cross-Government O365 KIM user group has been very positive. They have been at the forefront of sharing knowledge about O365 from a KIM perspective so that other departments and agencies can learn from their experiences.

- MOD has policies in place that discourage the use of WhatsApp, Slack, Trello and the like for official business and forbid their use for sensitive information. There are other collaborative options available to users via MODNET e.g. Defence connect, Planner, Teams and Groups. All these applications are available on mobile devices.

- Where the O365 platform is not appropriate e.g. for overseas deployment and when information is classified as SECRET MODNET utilises SharePoint on premise. The KIM team are still working with the MODNET programme to develop the RM solution for this, which may be via ‘ways of workings’ or via a plugin. MOD is also currently trialling ROSA but it is unclear how this will be used alongside MODNETs parallel SECRET tier.

- The March 2014 Digital Continuity policy and guidance is being revised. The plan is to include this in JSP 441. The policy will cover everything outside of MODNET as there is a digital continuity clause within the MODNET contract, this will be reflected in the upcoming revision of the Digital Continuity policy. (R2)

- There is existing AI research going on at MOD within their data science team, the KIM team will look to see how they can use this to enhance information findability e.g. for answering parliamentary questions, subject access requests, FOI requests and eventually to aid first and second review of files. This would be a great step and it would be appreciated if MOD shared their work in this area with the rest of the GKIM community.

Next steps to further improve ratings:

- Establish new processes for review, selection and export of digital records from HP Records Manager, the Historic Branches and O365.
- Mature processes for retention and disposal within all tiers of MODNET and across the O365 tenancy.
- Information Management within MODNET should also include provision for declassifying and moving material from SECRET to OFFICIAL maintaining, for example, retention metadata.

3 Information risk, governance and oversight

| Performance rating | IMA 2017 | Review 2019 | |-----------------------------|----------------|-------------| | Recognising information risk| Development area | Development area | | Establishing control | Satisfactory | Satisfactory | | Providing guidance | Satisfactory | Good | | Measuring impact | Satisfactory | Satisfactory |

- New 1\* Information Governance Board has been established although it has not yet met. The new Information Steward will chair the board that is comprised of the lead SIO from each TLB. The remit of the board is to have oversight of how MOD exploits, protects and manages risks around its information. (R 4)

- Digital Continuity risk: Risk capture and escalation will be via 1\* Information Governance Board to 3\* Chief Information Officer Council. (R2)

- O365 information management risk: All information management risks associated with O365 have been added to the ARM (Active Risk Manager) database. A Defence Authority Risk Manager has been assigned but this role will now need to transfer to the appropriate role within the new functional leadership structure. (R2)

- Information Assurance Risk: Reported to ISS Design Business Management team with escalation path to CIO where required. Risks identified in the Annual Assurance Reporting Exercise may also be raised to the Defence Audit, Risk and Assurance Committee. Again, this may change under the new functional leadership structure. (R2)

- It is also expected that a Functional Leader risk reporting process for information will be adopted once functional leadership begins. (R2) JSP 441 has been re-platformed to a wiki currently in BETA release with approximately 80% of content available to MOD staff. In moving JSP 441 to a wiki format, the KIM team have deliberately expanded its remit. It is now a one-stop shop for information management. They are aware they need to develop a printed copy for publishing on GOV.UK and easier accessibility for those deployed. This will likely be higher-level directives and principles. (R4)

The Holding to Account (H2A) exercise, MOD’s formal annual KIM assessment of its TLBs is complete for 2018. TLBs will develop action plans in Planner to work through in 2019 and facilitate improvement. The action plans are visible to all TLBs and discussed quarterly together at the internal MOD KIM Leaders meetings. There are also quarterly KIM Working Group meetings that have been set up to disseminate good practice. (R4) The output of the H2A exercise has been given to the CIO for consideration for inclusion in the Annual Assurance Report. (R4)

Next year’s H2A will likely work on a revised maturity and assurance model under the new Information Steward which will be less onerous to complete more readily allow for more iterative lessons learned and improvement. (R4)

The discovery and consultation phase of the Footprint review is now complete. The KIM team now know what roles, skills and activities they need across MOD to manage and exploit digital information. Now that they have this evidence, it needs to be acted upon to drive change.

Next steps to improve ratings:

- Integrate Information Management specific risks around retention, review, disposal, selection and transfer into the existing narrative around Information Assurance and Risk that already has traction within MOD.

4 Records, review and transfer

| Performance rating | IMA 2017 | Review 2019 | |------------------------------------------|-------------------|----------------------| | Oversight of records and selection | Development area | Development area | | Implementing disposal decisions | Development area | Development area |

MOD continues to issue its Defence Information Notice on 1 January that acts as a prompt for TLBs to report to the centre/DBS any information older than 15 years. In turn, this kicks off applications to the Advisory Council on National Archives and Records (ACNRA) for retention where necessary. The Holding to Account Exercise also requires business units to do an audit of their record holdings.

MODs appraisal report is due to be refreshed and re-published this year. This provides a good opportunity to engage with The National Archives to ensure MOD has a robust, transparent and accountable methodology for the review and disposal of records. The reviewers ‘blue book’ is currently also being updated. (R6) • MOD is now up to date with retention applications but needs to continue to engage with The National Archives in order to give regular updates to the ACNRA on these sets of records, which comprise a significant backlog, whilst they are under retention and not yet transferred. (R6)

• MOD is due to review its first digital collection relating to the Balkans Conflict that dates from 1995/1996. See section 2, above, for wider work that needs to be done to create processes for review, selection, export and transfer of MODs digital records. (R6)

• MOD should continue to work with The National Archives towards a workable solution for the transfer of the backlog of service records currently held under a retention instrument. (R6)

• Preparation of files and communication around transfers has improved considerably; see below for how this can be built upon.

Next steps to further improve ratings:

• Share a full one-year annual transfer plan in good time with a consistent level of detail throughout the plan and ensuring that transfer targets are realistic and can be delivered against to the end of the year with minimal intervention from The National Archives

• Engage with The National Archives to transfer MODs first batch of born-digital records (Balkans War records)

• Publish Appraisal report with the support of MOD senior management and with the input of business areas who are creating and will be reviewing the records to which it refers. Liaise with The National Archive’s Strategic Compliance team for support with this. Ensure you can demonstrate consistent selection and disposal decisions in line with the report going forward. Ensure there is a mechanism for recognising when an update is needed and that updates to the appraisal report are made transparently, for example, when functions change.

Next Steps

The National Archives will continue to support MOD in its work on information and records management via direct engagement on specific issues as they arise as well as through the GKIM O365 User Group and wider user research initiatives.

Annex A – 2017 recommendations

• Recommendation 1 MOD to define, articulate and communicate strategic goals for information and records management, establishing a clear strategic vision.

• Recommendation 2 MOD to ensure sufficient coverage of information management related risk within its risk management framework. • Recommendation 3 MOD to define how legislative and business requirements for information and records management will be met in the MODNET Office 365 environment.

• Recommendation 4 MOD to establish a framework through which the right information management culture can be driven and maintained. MOD should ensure good information management principles are embedded in new ways of working to get the most out of the MODNET Office 365 environment.

• Recommendation 5 MOD needs to identify how it will ensure the digital continuity of its information and records through to the point of transfer or destruction.

• Recommendation 6 MOD to work with The National Archives to establish a clear, achievable and agreed roadmap for ensuring compliance with the Public Records Act, supported by mutually agreed working plans.